Splunk Search

How to write query for Windows remote desktop connection?

afraanajam
Loves-to-Learn Everything

I am looking for Splunk query to find out Windows remote desktop service status and also to find to port 3389 is listening on server..

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Question is what kind of data you have in your Splunk.

Remember that Splunk is a data analytics solution, not an EDR, A/V, web-gateway or anything else.

So in order to find some information in it you first have to ingest the data. In other words - if you're not monitoring the system you want to query Splunk about, you won't get any information because Splunk doesn't know anything about.

0 Karma

afraanajam
Loves-to-Learn Everything

Any advice pls.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...